StealC: Cheat Tool to Emptied Wallet
A gamer chasing a free aimbot ran a fake cheat-tool installer, and within the hour the PC was beaconing to the internet and pinning its CPU. Follow the trail from a search-driven lure and an abused download through StealC's Run-key persistence and credential, wallet, clipboard, and screenshot theft to its HTTP exfiltration and a second-stage cryptojacker.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Open the case
0A home gaming PC started behaving oddly tonight: a sudden burst of outbound web traffic and a fan that will not stop spinning. The owner admits they went looking for a free game cheat earlier in the evening. You have the household web-filter, DNS, and endpoint records for the machine. Get oriented before you start pulling threads.
Trace the lure
20The intrusion began with a search for a cheat, not with an email. One site funneled the user toward the download. Working from the web-filter egress records, identify the site that served the fake cheat-tool landing page.
Identify what was run
20The download was a ZIP, but the harm came from the file the user ran out of it. On the endpoint, one process is the root of everything that follows. Name the executable the user launched.
Fingerprint the sample
20To check the binary against threat intelligence and to scope whether it landed elsewhere, you need its file hash. Recover the cryptographic hash recorded for the executable that was run.
Cut off the theft
20Once running, the binary harvested credentials, cookies, wallets, the clipboard, and a screenshot, then shipped the loot out. To contain the host and block the channel, identify the single host that received the stolen data.
Classify the second stage
20The intrusion did not stop at theft. After exfiltration, the stealer pulled a second payload from a different host and ran it to monetize the machine itself. Map that final objective to its MITRE ATT&CK technique.
6 tasks · 100 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allFortiOS Bypass to Hunters International Ransomware
Operators consistent with the Hunters International ransomware group abuse a FortiOS super-admin authentication bypass on an internet-facing FortiGate, plant rogue accounts, pivot over the SSL-VPN tunnel by RDP, sweep the network with Advanced IP and Port Scanner, and push roughly 6.8 GB of share data to a single external host over SFTP before running the encrypter. Work the FortiGate edge, the directory records, the perimeter egress, and the endpoint process tree to reconstruct the intrusion from entry to encryption.
Bumblebee Returns: The Voicemail VBA Macro
An accounts-payable clerk opened a voicemail-notification email, followed a OneDrive link, and a Word macro quietly pulled a loader onto the host. Follow the chain from a sender-spoofed phishing message through a VBA macro, PowerShell, and signed-binary proxy execution to the Bumblebee loader's TLS command-and-control.
QakBot bb02: Trace the Loader DLL to its C2
A purchasing coordinator opened a phishing email, downloaded a password-protected archive, and ran a shortcut on the disk image hidden inside it. A signed Windows utility quietly registered a QakBot DLL, and the workstation started beaconing to addresses nobody recognized. Trace the bb02 wave from a phishing link through an ISO and the loader DLL handoff to the single TLS command-and-control endpoint the bot settled on.